EUVD-2026-29809
GHSA-prpq-q5v3-q5v8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Management CLI is network-reachable (AV:N) but exploitation requires administrative privileges (PR:H); overflow yields full code execution, so C/I/A all High with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
AnalysisAI
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Technical ContextAI
AOS is the operating system running on HPE Aruba wireless LAN controllers and gateways, managing wireless services and network functions. The flaws are CWE-121 stack-based buffer overflows in several backend management service components that parse input supplied through the CLI. When these services copy attacker-controlled data into fixed-size stack buffers without adequate bounds checking, an overflow can overwrite the saved return address and adjacent stack memory, enabling control-flow hijack and native code execution in the context of the vulnerable service - which runs with elevated OS privileges. The affected component is identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), spanning both the AOS-8 (controller) and AOS-10 (cloud-native) branches.
RemediationAI
Upgrade to a fixed AOS release per HPE advisory hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the affected-version ranges imply fixes at or above 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and a patched 10.8.x build, but confirm the exact fixed version strings against the vendor advisory before deploying rather than relying on inferred numbers. Because exploitation requires administrative access to the CLI/management interface, the strongest compensating control until patching is to restrict and harden management-plane access: limit the CLI/management services to a dedicated out-of-band management VLAN or ACL-protected management subnet, permit administration only from trusted jump hosts, and avoid exposing management interfaces to user or internet-facing networks (trade-off: tighter ACLs can disrupt existing remote-admin and monitoring workflows). Additionally enforce strong, unique admin credentials with MFA, use role-based accounts with least privilege, and audit administrator logins, since a compromised or malicious admin is the primary threat actor for this bug.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today